Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Yatiraj_Panchal
Contributor
Jump to solution

What the problem, if getting two logs in Logs & Monitor

I'm getting one issue, I have blocked one IP address (Belong to Brasil) using SAM rule, but in GEO location Brasil allowed. When I checked logs in Logs & monitor, able to see two see 2 logs for every connection one for GEO location as permit and 2nd showing drop by SAM rule.

 

Thanks in a Advance!!

0 Kudos
2 Solutions

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Hi @Yatiraj_Panchal,

This is a normal behavior starting with R80.x. Depending on the processing level, it may be that the connection is allowed and then blocked. Here is a picture of the policy processing.

Screenshot_20200715-212113_Edge.jpg

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

Timothy_Hall
Legend Legend
Legend

To further clarify what Phoneboy said, legacy Geo Policy/Protection is applied right after Antispoofing.  R80.20+ Geo Policy objects are enforced by Firewall.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

View solution in original post

0 Kudos
6 Replies
HeikoAnkenbrand
Champion Champion
Champion

Hi @Yatiraj_Panchal,

This is a normal behavior starting with R80.x. Depending on the processing level, it may be that the connection is allowed and then blocked. Here is a picture of the policy processing.

Screenshot_20200715-212113_Edge.jpg

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Yatiraj_Panchal
Contributor

Hi @HeikoAnkenbrand,

Actual problem is traffic hitting to internal server, that's I'm able not able to understand. what's the alternative to stop hitting on internal server. 

0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

I do not understand the problem 100%. What exactly do you want to do?

If you do not want to use SAM rules, you can still use "fwaccel dos" protection. 

The SecureXL penalty box is a mechanism that performs an early drop of packets arriving from suspected sources. This mechanism is supported starting in R75.40VS.

Why not sam policy rules?

The SAM policy rules consume some CPU resources on Security Gateway. I recommend to set an expiration that gives you time to investigate, but does not affect performance. The best practice is to keep only the SAM policy rules that you need. If you confirm that an activity is risky, edit the Security Policy, educate users, or otherwise handle the risk. Or better use SecureXL penalty box from a performance point of view.

The purpose of this feature is to allow the Security Gateway to cope better under high load, possibly caused by a DoS/DDoS attack. These commands „fwaccel dos“ and „fwaccel6 dos“  control the Rate Limiting for DoS mitigation techniques in SecureXL on the local security gateway or cluster member.

In R80.20, all "sim erdos" commands are no longer supported. They have been replaced with equivalent commands which can be found under "fwaccel dos". Penalty box is configured separately for IPv4 and IPv6. IPv4 configuration is performed using the "fwaccel dos" command. IPv6 configuration is performed using the "fwaccel6 dos" command.

 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
Jarvis_Lin
Collaborator

Hi  HeikoAnkenbrand,

May you share me where is GEO & MOB legacy policy locate in policy match?

Thanks

 

Regards,

Jarvis

0 Kudos
PhoneBoy
Admin
Admin

Legacy GEO policy hits before the firewall.
Mobile Access Legacy Policy doesn't really apply in this flow since everything terminates on a specific process on the gateway.

0 Kudos
Timothy_Hall
Legend Legend
Legend

To further clarify what Phoneboy said, legacy Geo Policy/Protection is applied right after Antispoofing.  R80.20+ Geo Policy objects are enforced by Firewall.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events